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Scope 

Copy control relates to control of production, distribution and use of audio and/or video 
content (such as mov.es and music recordings.) It includes protection against unauthorized 
copying of content. It can also include parental control, play-once options, and related fields. 

This document reviews the current status of copy control from various angles, and suggests 
frLeworiT C ° Uld takC “ Pr ° VidiD8 3 general ^-operable copy control 


This framework is specifically designed to encompass rather than conflict with the work of 
otner existing bodies that are developing relevant standards. 

The editors can be contacted at the following e-mail addresses: 

Gene Itkis: itkis@ndsisrael.com 

Goran Eriksson: goe@teracom.se 
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Background 

WHY DO WE NEED COPY CONTROL? 

Content Providers are losing significant amounts of potential profits to pirates For examnle 

8 "“ p,ovided by 

* 0V "' 5 “"“ m Ky thu music industry alone, and this docs not 

n '" b ' r is “ ' re “ rd " 8 — ■ 

' L“* "■ pm "°" of 1 *- — — *«■ * - 

b “"“ C ° “* “ r8 ““ d uttntc has been demonstrated in some 


A similar situation is likely to be true for the video industry. 

Piracy in the digital domain is a greater problem than that of the analog domain because: 
• copies of digital content may be of the same quality as the original, 
distribution of digital material (e.g., over the internet) is much easier. 


• the tools for digital copying are mostly software, and much 
distribute. 


easier to develop, use and 


So, the purpose of copy control mechanisms is to maintain integrity of commerce systems 
by ensuring that those involved in the creative process are combated foTS 
contributions (financial and intellectual) and encouraged to continue them. This should 
include ensuring that the consumers get what they pay for - no more and no less. 

Creating a fair and competitive environment would benefit all the players. 


it 
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2 . 2 . 


PIRATES AND PIRACY 


2.2.1. Types of Piracy 

The following classification of piracy was suggested by IFPI and probably reflects the 
situation in other media and/or industries: 

• counterfeit: A pirate copy that looks identical to the original. 

^counterfeit CDs can, and have, been produced within a week from the official 

simple/back-catalog: Unauthorized compilations produced by pirates (without 
permission from the owners of rights to the material.) 

TOs type ° f piracy is especially lucrative and hard to enforce for older material, because 
it is not aiways known who owns the rights to old material. 

• bootlegging: Illegal recordings of a live performance. 

• home copying: Although this is not technically considered piracy, it is undesirable It is 
therefore also included in the discussion below. 

2.2.2. Piracy of Media vs. Players 

In the past pirates have copied the media. It the context of Pay-TV, pirates have also 
produced or modified equipment to obtain services without authorization. 

It is possible that in the future both these types of piracy will be relevant to copy control. 

Player piracy is generally more difficult and expensive for pirates because this involves 
developing or modifying expensive equipment. Such modifications would generally void 

di>mde tUrer WarrantCCS “ d serviccs ’ and wou * d therefore not be popular with the pirates’ 

2.2.3. Pirates: From Professional to Casual 

One way of classifying pirates is according to skill and access to equipment: 

a. Highly skilled, well-financed and well-equipped^ organizations; 

b. Fairly sophisticated (groups of collaborating) individuals, such as students. 

Typically such pirates have little more than a PC and some simple electronics available to 
them. They may also have access to some university facilities. 

c. Casual (relatively unsophisticated) users who are prepared to violate the law, but are able 

perform the piracy only if the necessary (simple) equipment and (straight-forward) 
instructions are made available to them. 
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In some cases they have access to laboratories equipped with electronic microscopes and similar 
equipment r 
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2.3. 


The above list represents points on a continuous spectrum of v,n«„« u, 

""*• “■ — - 

An alternative classification of piracy is based on the pirates’ motivation The „ t ■ , 

“rr y from ' ** - •— — — 

7L * *- «-* 

fri^nH 1 ^’ these || d ' stinctions are not a^ays clear, with some amateur pirates askinc their 

isz? - p-b'y »«*. «» *. ii-lt 2JL. 

v" 7 '»**> “ »”*'< —fr -*» 10 J. <* iL», £Z 

HOW MUCH PROTECTION IS “ENOUGH”? 

TTiere has been a tendency to divide the pirates into two vaguely defined groups fas 

discussed earlier). Reflecting the vagueness and confusion behind this division tL« „ 
are often referred to as casual and professional pirates. ’ d "" ^ 

Also, reflecting the difficulty in defending against professional piracy there has been a 
tendency to advocate only a limited defense, i.e., only against ciual piracy * 

As has been evident in similar technologies, there is a viable migration path between 

? ? “ o , Pir3Cy : ““ tem raay become Professional; and tools and 

rmat.on previously available to professionals may become available to amateurs It is 

furthermore our estimation that this type of migration is likely to become easier and 
commonplace with the proliferation of PCs, the Internet and associated tools and services. 

So it appears more prudent to assume that copy control mechanisms not addressing 
SSr eS ’ 316 y t0 qU,Ckly beCOme “ adequate even for c °py control against 

It is generally accepted that 100% security is unlikely to be achieved. Therefore the aim of 
good security is to, at least, make piracy financially unattractive: ideally, a pirate copy 
should end up costing more than a legitimate one. 4 

Reliable numbers required to estimate a good/reasonable cut-off point are generally 
unavailable. It is difficult to estimate in advance the pirates’ costs; both for development of a 
system to violate copy control mechanisms, and the distribution costs of the pirated 


3 A l Xampl ' has beenseen in pay-TV business where a system hack had been develop a, 

the nrnf« e Pr °^ SS10nai pirates ' within a ver >’ short time amateur pirates developed a hack of 

4 This critena is hard to evaluate for back-catalog and bootleg piracy since no identical legitimate 

copies are available. The notion of the “added value” provided bythe pirate and its cost should he 

estimated in order to provide a reasonable cut-off point for “ good^ugl^ 

pirates costs high enough to minunize/eliminate their profit margins). 8 
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2.4. 

2.4.1. 


materials/services. Therefore, this decision is generally made on the h«i« n f ■ • 
ungrounded assertions. S y adl 600 'he basis of speculation and 

The [jresem situation is further complicated by the fact that the Content Providers rrpi.. 

o are the proper judges of how much security is enoueh — can evhnrt nni / r - 

pressure on the Consumer Electronics manufacturers (CE)~ who must soend th*- 
to implement the solution for which they get no direct benefit. resources 

** CE , h T t0 66 motivated t0 d0 ** be« job possible. It would only be fair to 
P o ide them with adequate compensation for supporting the best solutions possible. 

Ideally, it would be more natural if the Content Providers use their budgets to control the 
choice of the security mechanisms/levels, balanced by the cost of implementing then! The 

the s”ecified e LSsms W ° Uld V,CW CUSt ° mer P3ym8 f ° r ** “Plantation of 

Currently, Content Providers typically subcontract the provision of security 
mechanisms/levels to Conditional Access/Security Providers (CA). 

One of the goals of the framework advocated in this document is to make this business 
model restructuring possible. This will be discussed in greater detail later. 

CURRENT COPY-CONTROL MECHANISMS 


Techniques 


Current copy-control techniques, and, specifically, 
encryption, data hiding (watermarking), and digital 
techniques were evaluated in the baseline 85 and 
CFP7-01 1. 


responses to DA VIC CFP7, include 
signatures. The potential of these 




encryption is typically employed to make the content unavailable to illegitimate users 

the^r f by fh pretending l ° be a le 8 itimate user - a P^te can obtain the content. To copy 
the content, the pirate needs to tap into the data path from the encrypted content to the 

played out content. Finding the most convenient place for this tap which will provide a 

high quality signal may present some degree of challenge to the pirate, but does not 

seem to be an intrinsically difficult task. In addition, the pirate generally needs to 

expend the financial and technical resources required to solve this problem only once to 
obtain all content encrypted in the same manner. 1 


ryptographic/digital signatures can be used to guarantee the integrity of the content 
and associate a proper authorization with the specific content. This method does not, 
however, address the issue of ensuring enforcement of the authorizations. 

• Watermarking resiliently embeds data in content. This can be used to: 

a. prevent illegitimate copies from being recorded and/or played. 

In this case, the requirement placed on the watermark is that it can be read/verified 
by every legitimate player/recorder. But, at the same time, it is essential that the 
pirates can neither obliterate nor change the watermark. Because the watermark- 
reading mechanism is to be present in every legitimate player, it is reasonable to 
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2.4.3. 


expect that the pirates will eventually discover all the secrets required for readin. 
these watermarks. Developing watermarks, which the pirate knows how to read L 
does not know how to modify or remove, appears to be an inherently verl dfficuS. 

and, some experts believe, even impossible problem. Y ^ lfilcult > 


b. 


mark specific content so it can be easily identified by its 
the ownership to be proven in court. 


owner, and possibly allow 


Here, the requirements placed on the watermarks are much weaker and 
watermark technologies are well suited to satisfy them. 


many 


Copy vs. Playback Control 


There are two distinct approacnes to provision of Copy Control. 

Prevention of production of unauthorized copies (for example, CCI copy bits.) 
• Prevention of playback of unauthorized copies. 


It is widely believed that everything that can be seen can be copied. This would 
suggest that the emphasis for Copy Control should be on the second approach. 


appear to 


Defenses Provided 


We can consider three types of defenses provided by the above mentioned techniques: 
1 . Authorizations 


For example, copy bits (CCI). These can be supported by either the 
the digital signatures or the integrity of the watermarks. 


cryptographic strength of 


2. Content inaccessibility for illegitimate use 


This can be supported by the encryption techniques. 
3 . 0 ff- line measures 


For example, law enforcement. This 
described earlier. 


can be supported by the second use of the watermarks 


TTie effectiveness of the second approach is likely to be limited, as argued above. While the off- 
line measures can be very effectively supported even with the existing technologies, the scope 
ot application of these measures is unfortunately rather restricted. So, it is our belief that 
while all three methods have important roles to play, the authorization-based approach 
appears to be the best choice for the main focus. The other methods should perhaps be best 
viewed as a means of enforcing the authorizations. 
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Looking Ahead 


3.1 


LEGAL APROACHES 

Copy control mechanisms can have different level of reliance on the legal mechanic ti, 
are two components to such legal mechanisms: 8 mechamsra - There 

• legislation; and 

• law enforcement. 

value oft ^ le 8 al means of enforcing copy control should not be ignored, we 
by cte bJ^ ^ m eValUatmg “ effectiveness < which should also be (tone on a case 

In particular, different countries have very different laws and legal systems 5 At the am , 

s :r T° p ™ t m - 1-~. *. .BM.. - 

often either difficult or non-existent Semi-anecdotal evidence is provided by the editors who 
” "V. "•»«> te, di^nbuBd » L Y«k by , 

or a iegmmate TV store salespeople in Sweden 6 advising customera against purchasing 
gitimate services and directing them to the black market 

The high cost of law enforcement can be illustrated by the pay-TV industry’s cases which 
dragged through the courts for years without reaching conclusions. It is aho very likely that 

Of their infrastructure, ieavmg only the lowest level distributors vulnerable to law^ P 
enforcement actions. 

The proliferation of computers and the Internet is likely to make it particularly easy for 
pirates to lower the effectiveness of law enforcement directed against them. 
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This problem has been exposed in the negotiations between China and the USA. 

It is interesting to note that Sweden is perceived to be particularly aggressive in its law enforcement 


against this type of piracy. 
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business approaches 

developed. “ ** ^ ^ “* bUSmCSS model for c °Py conttol is not very well 

The Pay-TV Model 

F* ™<U Md as follows: d» 

Tl» Coo,™ CSSSTT “ *• prevention, 

delivered. Conditional E° »»' 

p E ;r»e£“ s ^ 

love, of sendee drey retire m „ drei, re ” ™Sd“ £ “ ‘ h0 °“ ^ “<* 

Current Copy-Control Model 

pressunTon Sjr situation ° f cop V co ^oi the Content Providers apply only “political” 
compensated for “ons^P^^ “ « 

Objective 

nr#«ci C ^ CVe j V S a WOrt ^ y £ oa * t0 ^ t0 cr «ate a business model replacing the “Dolitical” 

sssTssr rapon!ibi,ife “ d •— *<“- - -Cffsis . 

Giving full control over the security choices to the Content Providers (who are the 

SSSSEjZT sta " i *■ ““ » dTO ™“ *»■ 

Creating a Security Provider role. These will be chosen and paid by the Content 
Providers and will be responsible for implementing security; * 

Compensating the CE industry for implementing the security mechanisms to the 
specificanons provided to them by the Security Provider. 
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INTERFACE WITH OTHER STANDARDS BODIES 

A number of forums and standards dealing with codv control exist for J . 

industries. Examples include CPTwr. / h--, i ' - anous media and 

» . . . " p,cs mclu<le CPTWG (dealing mamiy w th the DVD) VHS and 

“ S ’"* ‘ " a '° 8 ,i “' 0) ' “ d A «• M 

to deal with codv control k iuppr»_4 a c .. ^ *icaia specific body 

STa^ s 7 g 

that DA VIC would be able to adopt. X d P SOme solutlons 

ap r arS , that CPTW °’ S dec,ared focus raa y be too narrow to be adopted by DA VIC 

no, i»M » provid. *cpn,, f„ Ly « ^ (lt ’ 

players) and focus only on casual copying. generation of the 

h‘fhn„?d A T IC /° CUSeS ° n * m0re gl ° bal end - t0 - end sy««n view in the area of copy control 

above foafiV Tl Wlder \ more S' 0 '” 1 ’ “ d >°nger range solutions. We also Argued ’ 
above that it ,s h.ghly preferable to focus on the professional rather than casual P K“y 

Incorporating Standards in the Copy-Control Framework 
The current standards are each relevant within their specific domain. 

!m« ST? ^ 3t ** c °Py- contro1 framework to be developed would provide the interface 
into which all relevant current and future standards could be incorporated. 

In addition to fonnulating the framework, mechanisms for interfacing with existing and 

17 ^ s6 “ ,w *• m i *. 
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framework/interfaces vs. specific solutions 

lon8 ''“™ 8 — - - — « 

It is therefore our suggestion that the focus for DA VIC should h* ™ a ** i 

sotos mblf ? mte H aCeS WhlCh W0Uld ail0W short - |ived “ d technologic, fic 

solutions to be integrated to provide a stable long-range general copy contS 

Thus, DA VIC would develop a logical structure of authorizations and leave their 
nforcement and secunty maintenance details to the technology-specific methods. 

One of the aspects of this structure that becomes obvious is possibility to provide and 

support delegation of responsibility” from one entity to another fc.Jh „ P • d 
described in CFP7-0 II). entity to another (such a mechanism is 

models and scenarios than can be easily anticipated otherwise 7 . 

frit S nert qU ?r ent l may ^ CXpeCted fr0ra business community outside DA VIC once 

attrnrt- * ° e audlonzation structure is realized, thus potentially adding to the 

attractiveness and value of DA VIC. 7 8 omc 

It is therefore proposed that DA VIC undertake the mission of developing a standardized 
flexible authorization structure across technological platforms. 
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7 Therefore, it may affect the DA VIC baseline document #84 
information structure. 


which describes the copy-control 
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Conclusion 


we hay e advocated the development of a general framework which will integrate all 
technology-specific solutions into a single system for copy control. ^ 

Such a framework will support and encourage a business model that will facilitate the 
development, mamtenance and support of flexible and powerful copyJ 4 SmShtisms. 

toes'll 0n aUth0ri2ati0n - Technology-specific solutions, as well as 

echniques such as digital signatures, encryption, and watermarking can be used for the 
p 1 emen tation/ enforcement of the authorizations. 

Some realms which can be realized width, this approach have beep illustrated ip CFP7-01 1 

"»>««»» aed describes th, Copy-Ccpm,! Fra „„ ortt 
explicit and well structured authorizations. 


The Copy-Control Framework provides the interface 
future standards could be incorporated. 


into which all relevant current and 


By adopting and developing such a framework, DA VIC would be able to provide the 
opportunities and environment conducive to more powerful and flexible business support. 
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